Public Wi-Fi While Travelling: How to Assess Risks to Your Data
You can use public Wi-Fi during a trip if you verify the network, open services through familiar routes and take security warnings seriously. When a connection seems questionable, use mobile data or postpone an important transaction.
HTTPS encrypts information travelling between your browser and a website. An open hotspot therefore does not automatically expose every password to everyone nearby. However, an encrypted connection does not make a fraudulent website trustworthy, and a familiar Wi-Fi name does not prove who operates the network.
This guide covers personal phones and laptops in airports, accommodation, cafés and other shared spaces. An employer’s requirements also apply when using a work device.
Decide what you need before connecting
Looking up museum opening times and recovering your main email account have different consequences if something goes wrong. Set a specific purpose for the connection. If you only need an address or directions, you may already have enough information offline.
Save your accommodation address, contacts, arrival instructions and tickets before heading out. Use the ticket format accepted by the operator, and check that the material opens without a connection.
Download your destination city in RoadMe while you have internet access: its maps and navigation are available offline afterwards. Test them before travelling so finding your way does not depend on joining an unfamiliar hotspot.
A saved pin is different from downloaded map coverage. The guide to offline maps for travel explains how to check the areas and functions you need.
Confirm the hotspot with the venue
Ask a staff member for the exact guest-network name and the sign-in procedure. Compare that information with your device’s network list. Words such as “Free” or “Airport”, or the name of your hotel, are insufficient evidence on their own: someone else can operate a hotspot with a similar name.
A Wi-Fi password is not a guarantee of safety either. It concerns access to the network, rather than the authenticity of every website you subsequently visit.
Disable automatic joining for a temporary guest network. Once you leave, remove it from saved networks if you no longer need it. The setting names vary by device and are usually found in that network’s details.
Staff confirmation helps avoid choosing the wrong network. Continue checking websites and requests for information after connecting.
Treat the Wi-Fi sign-in page as a separate step
A hotspot may open a captive portal: a page asking you to accept terms, enter a guest code or complete the operator’s registration process. That page is not inherently a scam.
Check that its procedure matches the venue’s explanation. If a form unexpectedly requests your main email password or a code authorising a banking transaction, stop and ask what the request is for.
| What the page requests | Your next step |
|---|---|
| Acceptance of terms or a guest code | Compare the procedure with the venue’s instructions |
| A phone number, email address or guest information | Ask who collects it, why it is required and whether another access method exists |
| Installation of an app or configuration profile | Check its purpose and provider before installing anything |
| Disabling protection or dismissing a security warning | Stop the sign-in process and choose another connection |
Some networks require user identification. The procedure depends on the operator and location; registration is neither proof of fraud nor a universal requirement for public Wi-Fi.
A configuration profile is a separate change to the device. On an iPhone, profiles can define network and account settings. Do not approve one simply because a page promises free internet. For a work phone, refer the request to your organisation’s support team.
Check the destination website, not just the hotspot
Open an important service through its installed app, a saved bookmark or an address you already know. Avoid using an advertisement or convenient-looking button on the hotspot’s sign-in page to reach it.
In a browser, inspect the website address and connection information. HTTPS indicates encryption in transit; fraudulent websites can use it too. A familiar logo or a nearly identical domain does not replace an address check.
If the browser reports an invalid certificate, an insecure connection or a dangerous site, stop before signing in or paying. A warning may arise from the website, network or device, so it is not proof of an attack. It is still a reason to pause rather than bypass protection for an urgent task.
Check the connection and try another way to get online. If the issue continues, contact the service or device support team. Do not install a “fixing certificate” offered by an unfamiliar page.
Understand what a VPN covers
A VPN provides an encrypted connection between your device and a VPN server for traffic routed through it. It adds protection in transit; it does not establish that a website is genuine.
It cannot undo your decision to submit a password to a fake form or approve someone else’s sign-in request. You also need to trust the provider operating the server through which your connection passes.
If you intend to use a VPN, install it from an official source before departure and test it. Check which apps and connections it covers. Having the VPN app open is different from having an active VPN connection.
On a work device, use the access method approved by your organisation. Also check whether your chosen service will be available at your destination before depending on it.
Match the connection to the consequences
For an important task, have an alternative to an unfamiliar public hotspot. Mobile data avoids that particular hotspot, but it does not prevent phishing or make a fraudulent website legitimate.
| What you need to do | A practical approach |
|---|---|
| Read a public timetable | Verify the network and open the official website |
| Find your accommodation | Use a prepared offline map |
| Access an important account when the network seems questionable | Switch to mobile data or postpone signing in |
| Connect to work systems | Follow your organisation’s rules |
| Download a large file | Check the network, file source and whether the download is necessary |
These are decision steps, not guaranteed safety ratings. Before travelling, check mobile coverage, costs and the services you need. The guide to travel eSIMs, local SIMs and roaming compares the options.
Prepare the device and finish the session deliberately
Update the operating system, browser and apps before departure. Give important accounts different strong passwords and enable a supported second authentication factor. Confirm that the sign-in method will remain accessible during your trip.
Remember that a public place also exposes your screen to other people. Someone can observe a password or code without interfering with Wi-Fi. Keep an unlocked phone with you when you go to ask staff about the network.
Before disconnecting, finish the intended task and check any downloads. If you have prepared material for tomorrow, confirm that it has been saved rather than merely left open in a tab.
While you have your chosen connection, use RoadMe to plan the next day’s sightseeing around your interests and pace. Add places you like to favourites to collect them on your personal map.
Disconnect from the temporary network and review its automatic-join setting. If you no longer need Wi-Fi, turn it off in the device’s settings.
If you have already submitted information to a suspicious page
Close the page and disconnect. Simply joining a network, without submitting information or installing anything, does not prove that your accounts have been compromised.
If you entered a password, open the genuine service using another connection and a trusted device. Change that password, sign out active sessions where the service allows it and review account recovery details. Replace the password elsewhere if you reused it.
If you approved an unfamiliar sign-in or lost access, follow the service’s official recovery process. If you supplied payment details or authorised an unknown transaction, contact your bank through its app or a contact you already know. An unfamiliar app or profile you installed needs a separate device review; contact organisational support promptly for a work device.
Before entering information, check three things: which network you joined, which service you opened and whether the request matches an action you initiated.
